Description
ExpressVPN before 12.73.0 on Windows, when split tunneling is used, sends DNS requests according to the Windows configuration (e.g., sends them to DNS servers operated by the user's ISP instead of to the ExpressVPN DNS servers), which may allow remote attackers to obtain sensitive information about websites visited by VPN users.
Published: 2024-02-11
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 16 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00272}

 epss

{'score': 0.00196}

Wed, 30 Oct 2024 20:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-922
CPEs cpe:2.3:a:expressvpn:expressvpn:*:*:*:*:*:*:*:*
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 05 Sep 2024 14:15:00 +0000

Type Values Removed Values Added
First Time appeared Expressvpn
Expressvpn expressvpn
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:a:expressvpn:expressvpn:*:*:*:*:*:windows:*:*
Vendors & Products Expressvpn
Expressvpn expressvpn
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Expressvpn Expressvpn
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2024-10-30T19:12:30.970Z

Reserved: 2024-02-11T00:00:00.000Z

Link: CVE-2024-25728

cve-icon Vulnrichment

Updated: 2024-08-01T23:52:06.236Z

cve-icon NVD

Status : Modified

Published: 2024-02-11T22:15:08.360

Modified: 2024-11-21T09:01:17.043

Link: CVE-2024-25728

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses